| 1 | # Review brief: console email sign-in spec (rev 1) |
| 2 | |
| 3 | Repo: carlos/platform, branch `email-signin`, commit 49eaacf0. |
| 4 | Spec: `docs/superpowers/specs/2026-10-21-console-email-signin-design.md`. |
| 5 | |
| 6 | You are an independent reviewer. Read the spec, then read the code it |
| 7 | changes to check every claim against it: `internal/console/server.go` |
| 8 | (handleContinue, handleSignin, handleCallback, handleConfirm, |
| 9 | handleInvite, handleInvitePage, handleAcceptInvite, session, setCookie), |
| 10 | `internal/console/stepup.go`, `internal/console/keymail.go`, |
| 11 | `internal/console/keymailfed.go`, `internal/console/consolemail.go`, |
| 12 | `internal/console/authcli.go` (device flow, clientIP, notifyCLIIssued), |
| 13 | `internal/console/store.go` (sessions, confirmations, invites), |
| 14 | `internal/console/store_gate.go` (claimSQLTables), `cmd/console/main.go` |
| 15 | (consoleMailer wiring), `infra/modules/region-host` (console_mail_*). |
| 16 | |
| 17 | Rulings R1-R4 in §2 are Paul's and fixed. Do not re-argue them; report |
| 18 | only mechanisms that fail to honour them. |
| 19 | |
| 20 | Report, ranked P1 (security hole or will not work) / P2 (real defect) / |
| 21 | P3 (worth fixing): |
| 22 | - security holes: session fixation, login CSRF, downgrade of Keymail |
| 23 | sessions to email re-confirmation, oracles (account existence, Keymail |
| 24 | mailbox existence, rate limiting), token/code brute force, link |
| 25 | scanners consuming tokens, open redirects via `next`, the pending |
| 26 | action being swapped or replayed, mail-cannon abuse; |
| 27 | - places the spec contradicts the code or would break an existing flow |
| 28 | (Keymail sign-in, the Apps-inbox confirmation, invites, CLI login, |
| 29 | claim-mode gates); |
| 30 | - missing pieces a builder would trip over. |
| 31 | |
| 32 | For each finding: the spec section, the code location (file:line) that |
| 33 | proves it, the failure scenario, and a suggested fix. Verify every code |
| 34 | citation. Do not edit files. Do not spawn Anthropic-model reviewers or |
| 35 | subagents of your own. Do not run the full test suites. |
| 36 | |
amadan